Title: [187769] branches/safari-601.1.46-branch/Source/WebCore
- Revision
- 187769
- Author
- [email protected]
- Date
- 2015-08-03 14:49:30 -0700 (Mon, 03 Aug 2015)
Log Message
Merge r187731. rdar://problem/22052829
Modified Paths
Diff
Modified: branches/safari-601.1.46-branch/Source/WebCore/ChangeLog (187768 => 187769)
--- branches/safari-601.1.46-branch/Source/WebCore/ChangeLog 2015-08-03 21:49:28 UTC (rev 187768)
+++ branches/safari-601.1.46-branch/Source/WebCore/ChangeLog 2015-08-03 21:49:30 UTC (rev 187769)
@@ -1,3 +1,23 @@
+2015-08-03 Matthew Hanson <[email protected]>
+
+ Merge r187731. rdar://problem/22052829
+
+ 2015-08-01 Chris Fleizach <[email protected]>
+
+ AX: On some complex sites, iOS instantly crashes once VoiceOver is turned on
+ https://bugs.webkit.org/show_bug.cgi?id=147529
+
+ Reviewed by Dan Bernstein.
+
+ Sometimes after focusing on a node, it seems like the entire document is destroyed.
+ Accessibility the axObjectCache returns nullptr and we crash.
+
+ Despite my best efforts, I couldn't make a layout test that reproduced this. It's possible
+ the entire document needs to be destroyed and replaced with something.
+
+ * accessibility/AccessibilityRenderObject.cpp:
+ (WebCore::AccessibilityRenderObject::setFocused):
+
2015-08-01 Babak Shafiei <[email protected]>
Merge r187686.
Modified: branches/safari-601.1.46-branch/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (187768 => 187769)
--- branches/safari-601.1.46-branch/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2015-08-03 21:49:28 UTC (rev 187768)
+++ branches/safari-601.1.46-branch/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2015-08-03 21:49:30 UTC (rev 187769)
@@ -1677,21 +1677,23 @@
return;
}
+ // When a node is told to set focus, that can cause it to be deallocated, which means that doing
+ // anything else inside this object will crash. To fix this, we added a RefPtr to protect this object
+ // long enough for duration.
+ RefPtr<AccessibilityObject> protect(this);
+
// If this node is already the currently focused node, then calling focus() won't do anything.
// That is a problem when focus is removed from the webpage to chrome, and then returns.
// In these cases, we need to do what keyboard and mouse focus do, which is reset focus first.
if (document->focusedElement() == node)
document->setFocusedElement(nullptr);
- // When a node is told to set focus, that can cause it to be deallocated, which means that doing
- // anything else inside this object will crash. To fix this, we added a RefPtr to protect this object
- // long enough for duration. We can also locally cache the axObjectCache.
- RefPtr<AccessibilityObject> protect(this);
- AXObjectCache* cache = axObjectCache();
-
- cache->setIsSynchronizingSelection(true);
- downcast<Element>(*node).focus();
- cache->setIsSynchronizingSelection(false);
+ // If we return from setFocusedElement and our element has been removed from a tree, axObjectCache() may be null.
+ if (AXObjectCache* cache = axObjectCache()) {
+ cache->setIsSynchronizingSelection(true);
+ downcast<Element>(*node).focus();
+ cache->setIsSynchronizingSelection(false);
+ }
}
void AccessibilityRenderObject::setSelectedRows(AccessibilityChildrenVector& selectedRows)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
